If CLI has already assumed a IAM Role, then the cli environment has an additional variable: AWS_SESSION_TOKEN This needs to be forwarded to boto to successfully reuse the AWS session in boto.